PT-2026-85095

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-84753: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

CVE-2026-84834: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

CVE-2026-84752: Deserialization of Untrusted Data

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-77999: External Control of Assumed-Immutable Web Parameter

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-84968: Out-of-bounds Read

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

CVE-2026-76174: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

PT-2026-85201

Name of the Vulnerable Software and Affected Versions MongoDB PHP driver affected versions not specified Description An out-of-bounds read occurs in the BSON decoding component. An unauthenticated party can provide specially formed input to cause a small amount of adjacent process memory to be...

PT-2026-85096

Name of the Vulnerable Software and Affected Versions Mail Mint versions prior to 1.31.1 Description Mail Mint is subject to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to inject a PHP Object. While no POP chain a sequence of gadgets...

PT-2026-84973

Name of the Vulnerable Software and Affected Versions Ocsreports affected versions not specified Description An unrestricted file upload issue exists in the CSV file upload functionality of the 'admin info' endpoint. The application validates files based only on the client-provided name, failing ...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

CGA-2PHP-XFR5-32X4

Bulletin has no description...

EUVD-2026-70265

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-4357

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

EUVD-2026-68891

Sulu: Stored XSS via media download inline-disposition override...

EUVD-2026-68888

Sulu: Media move/update authorization bypass IDOR...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...